I am working on a project where I have to identify anomalies in network traffic of business networks with machine learning. The algorithm is feeded with captured network packets from inside of the business LAN. Since the business is located in Europe, constraints by the GDPR have to be considered.

My Question: is there a tool or a procedure to capture, anonymize and then save network packages with following constraints:

  1. values should stay unique when anonymized (e.g. the same IP address should always be encrypted to the same hash value and any other IP addresses must have a different hash value). This is important so the hash can still be used as a feature for the ML model.

  2. the process of capturing and saving the packtes and the commercial use of the resulting, partially hashed data packets should comply with the GDPR guidelines. The packets are recorded on a computer whose owner has agreed. However, not everyone on the network knows that it is sniffed.

I would appreciate CLI or GUI tools, preferrably for Ubuntu, or free python packages. If there is no such tool, what do I have to consider when implementing it myself?

What I have tried: I have been searching for tools specifically to capture network traffic and anonymize source and destination IP and MAC adresses and found pktanon. Data captured by tcpdump can be piped to pktanon and anonymized, before it is saved. Also, the payload is completely deleted beforehand.

Though, apparently it is not sufficient to anonymize IP and MAC addresses. For example, it might be possible to recalculate parts of the payload with the checksum. I'm not 100% sure if this is relevant and also I do not know which encryption algorithms meet the requirements of the GDPR.

Since this is a prototype, free software is preferred. I am happy about every reference to software up to a few hundred € or $ annually.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy